Unauthorized Access Vulnerability in EdgeConnect SD-WAN by HPE
CVE-2025-37131

4.9MEDIUM

Key Information:

Vendor

HP (HP)

Status
HP Aruba Networking Edgeconnect Sd-wan Gateway
Vendor
CVE Published:
16 September 2025

What is CVE-2025-37131?

A vulnerability in EdgeConnect SD-WAN ECOS permits authenticated remote threat actors with admin rights to gain access to sensitive unauthorized system files. This access, if exploited under specific conditions, could result in the exposure and potential exfiltration of confidential information, posing a serious risk to system integrity and data security.

Affected Version(s)

HPE Aruba Networking EdgeConnect SD-WAN Gateway 9.5.0.0 <= 9.5.3.6

HPE Aruba Networking EdgeConnect SD-WAN Gateway 9.5.0.0 <= 9.5.3.6

HPE Aruba Networking EdgeConnect SD-WAN Gateway 9.4.0.0 <= 9.4.3.7

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NCC Group
JSON
.